Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arduino FIDO2 Authenticator

en.ovcharov.me

Post reply on HN
Print view View original

41–50 of 90 posts

Re: Arduino FIDO2 Authenticator

#41

Post by StavrosK »

alias_neo wrote: post #40
StavrosK wrote: post #35

Earlier quoted context omitted.

Oh, it's just U2F? You want FIDO2 with resident key support to get the really nice OpenSSH workflow (plug the key in to a new computer, run ssh-add -k, now you can SSH to all your computers).

Can I do this with a Yubikey? Last time I tried there were a few, more complex commands than this. Could I use a udev rule to add my SSH keys as the device is plugged so I don't have to run anything? I think I was using PIV last time.

Yes you can, SSH 8.3ish uses FIDO2 and doesn't do anything Yubikey-specific. That means you don't have to bother with all the agent stuff, and it works with any dirt-cheap FIDO2 key.

EDIT: I'm going to post a writeup tomorrow detailing how to do this, because it's wonderful and super secure.

Re: Arduino FIDO2 Authenticator

#42

Post by tialaramex »

alias_neo wrote: post #40
StavrosK wrote: post #35

Earlier quoted context omitted.

Oh, it's just U2F? You want FIDO2 with resident key support to get the really nice OpenSSH workflow (plug the key in to a new computer, run ssh-add -k, now you can SSH to all your computers).

Can I do this with a Yubikey? Last time I tried there were a few, more complex commands than this. Could I use a udev rule to add my SSH keys as the device is plugged so I don't have to run anything? I think I was using PIV last time.

Yes, any vaguely modern YubiKey implemented FIDO2 which is what you need.

However you need fairly modern OpenSSH (this year) for both clients and servers. Both need to be upgraded because the authentication protocol itself is different, so an older server has no idea how to authenticate with FIDO2.

To get the behaviour the parent describes you must make sure to follow the instructions for resident keys, and these instructions won't work on cheaper FIDO (not FIDO2) devices that designed be used as second factors. Without resident keys the authenticator only works when at the computer you used to enrol it, which is fine for a personal workstation/ laptop but not great if you need to roam.

Re: Arduino FIDO2 Authenticator

#43

Post by alias_neo »

snakeye wrote: post #37
StavrosK wrote: post #36

Earlier quoted context omitted.

Is Bluetooth not encrypted? It would be disastrous if just anyone could read what your Bluetooth keyboard is sending.

It is encrypted with MITM protection. That's why I do not believe in severe security issues in BLE. There can be problems with particular implementations, but in general it should not be less secure that typing password on a keyboard.

Your keyboard very likely isn't using BLE (Bluetooth Low-Energy). The issue appears specific to BLE which behaves differently than Bluetooth X (4.0, 4.1, 5.0, etc) "proper" and has a different security profile.

Re: Arduino FIDO2 Authenticator

#44

Post by gruez »

ChrisSD wrote: post #29
gruez wrote: post #21

Earlier quoted context omitted.

That's surprisingly cheap, less than $10 for a token. Any downsides?

No FIDO2 so it won't work with everything. No NFC.

What are some use cases where you must use FIDO2? A sibling comment mentioned SSH authentication, but what about websites?

Re: Arduino FIDO2 Authenticator

#45

Post by alias_neo »

TrueDuality wrote: post #30

> But, wait, is it difficult to find a charger or power bank with Micro USB nowadays? It's definitely trending that way IME...

I understood the point the article was trying to make here, but, actually, it's become almost a nightmare to find a Micro USB cable in my home, so I had to answer "yes".

Every time one breaks or gets tatty I bin it and don't replace, because, really, the only thing I need it for is my PS4 controller and the baby monitor. I've burned through a decade or so worth of them thrown in boxes and drawers.

It gets really hard these days to find one when I need to charge my PS4 controller and the baby monitor needs charging at the same time.

While I'm on the go, I guarantee I don't have one. Phone, wife's phone, Switch, tablet, power bank, laptop, earbuds, all USB-C charging. It's taking me some time and careful purchasing choices to get to the point where I can carry a single power brick to fast charge all the devices I carry with one connector/cable, adding Micro USB back in would actually be an inconvenience.

Re: Arduino FIDO2 Authenticator

#46

Post by alias_neo »

tialaramex wrote: post #42
alias_neo wrote: post #40

Earlier quoted context omitted.

Can I do this with a Yubikey? Last time I tried there were a few, more complex commands than this. Could I use a udev rule to add my SSH keys as the device is plugged so I don't have to run anything? I think I was using PIV last time.

Yes, any vaguely modern YubiKey implemented FIDO2 which is what you need. However you need fairly modern OpenSSH (this year) for both clients and servers. Both need to be upgraded because the authentication protocol itself is different, so an older server has no idea how to authenticate with FIDO2. To get the behaviour the parent describes you must make sure to follow the instructions for resident keys, and these ins…

Thanks, I have a few 5C's so they should be new enough, I'll need to check my laptop/desktop to make sure SSH is new enough (I run Ubuntu 20.04/Manjaro respectively).

My servers most likely aren't, but I run most of my workloads in Docker or Kubernetes so it's just a matter of time to get them all updated.

Re: Arduino FIDO2 Authenticator

#47

Post by StavrosK »

tialaramex wrote: post #42
alias_neo wrote: post #40

Earlier quoted context omitted.

Can I do this with a Yubikey? Last time I tried there were a few, more complex commands than this. Could I use a udev rule to add my SSH keys as the device is plugged so I don't have to run anything? I think I was using PIV last time.

Yes, any vaguely modern YubiKey implemented FIDO2 which is what you need. However you need fairly modern OpenSSH (this year) for both clients and servers. Both need to be upgraded because the authentication protocol itself is different, so an older server has no idea how to authenticate with FIDO2. To get the behaviour the parent describes you must make sure to follow the instructions for resident keys, and these ins…

Not strictly true, you can copy the "private" key (just a pairing file for the dongle) around and still use the USB key fine with it.

Re: Arduino FIDO2 Authenticator

#48

Post by alias_neo »

StavrosK wrote: post #41
alias_neo wrote: post #40

Earlier quoted context omitted.

Can I do this with a Yubikey? Last time I tried there were a few, more complex commands than this. Could I use a udev rule to add my SSH keys as the device is plugged so I don't have to run anything? I think I was using PIV last time.

Yes you can, SSH 8.3ish uses FIDO2 and doesn't do anything Yubikey-specific. That means you don't have to bother with all the agent stuff, and it works with any dirt-cheap FIDO2 key. EDIT: I'm going to post a writeup tomorrow detailing how to do this, because it's wonderful and super secure.

Thanks, going to look into it more tonight, see if I can get a 5C setup.

Re: Arduino FIDO2 Authenticator

#49

Post by snakeye »

alias_neo wrote: post #43
snakeye wrote: post #37

Earlier quoted context omitted.

It is encrypted with MITM protection. That's why I do not believe in severe security issues in BLE. There can be problems with particular implementations, but in general it should not be less secure that typing password on a keyboard.

Your keyboard very likely isn't using BLE (Bluetooth Low-Energy). The issue appears specific to BLE which behaves differently than Bluetooth X (4.0, 4.1, 5.0, etc) "proper" and has a different security profile.

You are probably right. However, the BLE transport was not removed from the 2.1 specification and supported by Microsoft Hello. And, anyways, for Arduino based DIY project existing security is more than enough.

Re: Arduino FIDO2 Authenticator

#50

Post by StavrosK »

alias_neo wrote: post #48
StavrosK wrote: post #41

Earlier quoted context omitted.

Yes you can, SSH 8.3ish uses FIDO2 and doesn't do anything Yubikey-specific. That means you don't have to bother with all the agent stuff, and it works with any dirt-cheap FIDO2 key. EDIT: I'm going to post a writeup tomorrow detailing how to do this, because it's wonderful and super secure.

Thanks, going to look into it more tonight, see if I can get a 5C setup.

It is literally just the two commands, I can send them to you when I'm at the pc. I have a 5C too.
Post reply on HN